Computing networks can include multiple network devices such as routers, switches, hubs, servers, desktop PCs, laptops, workstations, and peripheral devices, e.g., printers, facsimile devices, and scanners, networked together across a local area network (LAN) and/or wide area network (WAN).
Networks can include a network appliance (NA), e.g., a checking functionality (CF) such as an intrusion prevention system (IPS) and/or intrusion detection system (IDS) that serves to detect unwanted intrusions/activities to the computer network. Unwanted network intrusions/activities may take the form of attacks through computer viruses and/or hackers, among others, trying to access the network. To this end, a CF can identify different types of suspicious network traffic and network device usage that can not be detected by a conventional firewall. This includes network attacks against vulnerable services, data driven attacks on applications, host based attacks such as privilege escalation, denial of service attacks, port scans, unauthorized logins and access to sensitive files, viruses, Trojan horses, and worms, among others. An NA can also include other forms of diagnostic devices, accounting devices, counting devices, etc., operable on network packets of interest.
Network appliances are a class of products that provide network security services such as firewalling, intrusion detection, content filtering, spam filtering, and/or virtual private networks (VPNs). Network appliances arose and evolved independently of traditional high-speed network infrastructure devices such as routers, switches, bridges, etc. However, the underpinnings of modern network appliances are in fact a bridging or routing engine that in many instances replicates the functionality of the traditional high-speed network infrastructure device.
Network appliances, e.g., IPS/IDSs, counting/accounting, or diagnostic devices, may be slower than other network devices, such as switches and routers, and hence have slower throughput. Additionally, network appliances tend to replicate bridging and routing functions that have already been well-optimized and are significantly faster in network infrastructure devices, e.g., routers, switches, etc. For example, network devices have become more “intelligent” in their decision making capability at very fast speeds, e.g., 100+Gbps. In contrast, network appliances can be several orders of magnitude slower in terms of throughput as compared to such modern high-speed network devices. Network appliances also tend to introduce latency issues when compared to network devices. Latency is a troublesome facet to introduce into a network because it negatively effects real time applications such as voice over IP (VoIP), e.g., latency can cause choppiness in conversations, etc., or storage area networks (SANs), e.g., latency can cause slow file operations.
Previous approaches use network appliances to examine each packet to determine what security-related action should be taken with respect to the packet. In some cases, the network appliance can signal the network device that a port should be disabled. However, if this port is shared among many users, or if a host is shared among many applications, disabling the port penalizes too many users.